---
title: "Create a Core protocol key for an Accounts-authorized workspace"
method: POST
path: "/v1/internal/workspace-credentials/issue"
---

# Create a Core protocol key for an Accounts-authorized workspace

`POST /v1/internal/workspace-credentials/issue`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/internal/workspace-credentials/issue`
- Auth: HTTP bearer

Disabled until the dedicated Accounts service credential is configured. Accounts authorizes current owner/admin membership and Commerce access, then signs a command bound to its exact organization, workspace, user, environment and protocol purpose. Core requires a synchronized existing workspace projection, verifies the signature through the configured Accounts JWKS and checks authorization expiry after lock waits. Commands expire within 60 seconds; issued_at may be at most 5 seconds ahead. command_id is globally immutable across actors, workspaces and actions; only authorization timestamps may change on retry. JSON only, no query parameters, cookies or Origin header. This creates no native platform connection and grants no ERP execution authority. Core uses its existing key generator and hash storage with fixed MEMBER decision:read/decision:write scopes. Only the first successful response discloses raw_key. No recoverable response ciphertext is stored. An authorized retry returns already_issued metadata; a lost first response requires explicit revocation and a new command.

## Request body

- AccountsWorkspaceCredentialIssueEnvelope
  - `payload` AccountsWorkspaceCredentialIssueCommand, required
    - `version` 'accounts-workspace-credential-v1', required
    - `command_id` string, uuid, required
    - `purpose` 'protocol', required
    - `account_org_id` string, required
    - `account_workspace_id` string, required
    - `account_user_id` string, required
    - `product` 'commerce', required
    - `environment` 'sandbox' | 'production', required
    - `role` 'owner' | 'admin', required
    - `issued_at` string, date-time, required
    - `authorization_expires_at` string, date-time, required
    - `action` 'issue', required
    - `label` string, required
  - `evidence` AccountsWorkspaceCredentialEvidence, required
    - `algorithm` 'Ed25519', required
    - `key_id` string, required
    - `payload_sha256` string, required
    - `signature` string, required

## Response `200`

Previously issued credential metadata; no raw key

- AccountsWorkspaceCredentialAlreadyIssued (unresolved $ref)

## Other responses

- `201`: New credential; raw key disclosed once
- `400`: Invalid or conflicting bounded command fields
- `401`: Dedicated Accounts service authentication required
- `403`: Command authority or exact workspace projection denied
- `404`: Credential is not in the authorized workspace namespace
- `409`: Command identity or credential binding conflicts
- `413`: Command exceeds the 8192-byte body limit
- `429`: Durable per-address or workspace request limit reached
- `503`: Credential adapter or required dependency unavailable

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)